BR112016020392B1 - ACCESS NODE DEVICE, ACCESS NODE METHOD, GATEWAY NODE DEVICE AND GATEWAY NODE METHOD - Google Patents

Abstract

ACCESS NODE DEVICE, ACCESS NODE METHOD, GATEWAY NODE DEVICE, AND GATEWAY NODE METHOD. The present invention relates to an access node device (1) arranged to receive and forward data packets in a communication network (2), wherein the device comprises at least one processor (20) arranged to: receive packets data from a user node (3); and forwarding the data packets in a stateless mode over a first path to a destination gateway node (4), wherein the first path is a default path, or forwarding the data packets in a stateful mode over a second path to a target node, wherein the second path is determined by user and/or session specific information for said user node (3). Additionally, the invention also relates to a corresponding gateway node device, a method at an access node, a method at a gateway node, a computer program and a computer program product thereof.

Description

FIELD OF TECHNIQUE

[001] The present invention relates to an access node device for receiving and forwarding data packets in a communication network. Additionally, the invention also relates to a corresponding gateway node device, a method at an access node, a method at a gateway node, a computer program and a program product. of the same computer.

BACKGROUND OF THE INVENTION

[002] Applications running on mobile devices are increasingly diverse, which requires new requirements for wireless communication networks. Currently, smart phones, laptop computers and tablet computers are the most frequently used mobile devices, but machines that communicate with other machines without human intervention are expected to become the most common devices in wireless communication networks. in the future.

[003] Current wireless communications are not appropriately adapted for this type of communication, which sporadically leads, in particular, to communication standards when a small amount of data is sent, to significant performance ineffectiveness. This is a consequence of the tight security and Quality of Service (QoS) management that networks support but that many applications do not need. This has been noticed by network operators and vendors, that efforts are ongoing to handle machine-like communication in the Evolved Packet System (EPS) and Long Term Evolution (LTE).

[004] In the longer term, even greater changes to the network architecture are expected with closer integration of networks based on IEEE 802.11 (WLAN) and cellular networks, as well as more dynamic roaming arrangements between service providers and network infrastructure providers.

[005] However, the present solution in EPS/LTE is ineffective for single data packets due to: configuration of tunnel range for Authentication, Authorization and Audit (AAA), context search of User Equipment (UE), etc. These tasks create significant signaling and processing overhead on the network for connections consisting of very few packets. When data packets are to be sent over LTE/EPS from a UE that is initially in a Radio Resource Control (RRC) idle state, a service request procedure is used, where the UE context is transferred to the eNB. The LTE UE context contains UE Identities (IDs), bearer information and security information (eg encryption keys). This causes significant signaling and delay for small data transfers, which has been identified as a significant problem in today's mobile networks as traffic patterns become more diverse.

[006] Therefore, 3GPP currently works in accents for Machine Type Communications (MTC). Proposed solutions include allowing data to be sent over the control channels instead of the user plane to reduce the required programming. Another approach is to maintain the established security context between the UE and a core network node instead of the eNB, which was also the solution in General Packet Radio Service (GPRS). This reduces the required signaling when a transmission starts.

[007] The proposed solutions related to the MTC study item in 3GPP improve the current EPS network architecture by supporting connectionless services in a more efficient way. However, in the long term, a new architecture that inherently matches the requirements of both connectionless and connection oriented services is preferable. The solution must also support dynamic roaming between different network types and service providers in an effective manner. In addition to the signaling and processing overhead, there is also the issue of large delays for initial packets when a connection is set up.

[008] In terms of security, current solutions provide good support for encryption in the access network. However, there are many conceivable attack vectors, and given denial of service attacks, it is generally dangerous to have procedures in which a small amount of traffic from a host causes a large amount of work for the network.

SUMMARY

[009] An object of the present invention is to provide a solution to mitigate or solve the disadvantages and problems of prior art solutions.

[0010] According to a first aspect of the invention, the objectives mentioned above and others are achieved with an access node device (1) arranged to receive and forward data packets in a communication network (2), wherein the device comprises at least one processor (20) arranged to: receive data packets from a user node (3); and forwarding the data packets in a stateless mode over a first path to a destination gateway node (4), wherein the first path is a default path, or forwarding the data packets in a stateful mode over a second path to a target node, wherein the second path is determined by user and/or session specific information for said user node (3).

[0011] According to a second aspect of the invention, the aforementioned and other objects are achieved with a communication network (2) comprising at least one access node device (1) according to the present invention.

[0012] According to a third aspect of the invention, the aforementioned and other objects are achieved by a method in an access node arranged to receive and forward data packets in a communication network (2), wherein the method comprises the steps of: receiving (100) data packets from a user node (3); and forwarding (200) the data packets in a stateless mode along a first path to a destination gateway node (4), wherein the first path is a default path, or forwarding (300) the data packets in a stateful mode by a second path to a destination node, wherein the second path is determined by user and/or session specific information for said user node (3).

[0013] According to a fourth aspect of the invention, the aforementioned and other objects are achieved with a gateway node device (4) of a communication network (2), comprising at least one processor (30 ) disposed to: receive data packets from a user node (3); identifying said user node (3); and transmitting instructions to one or more access node devices (1) whether data packets from said user node (3) are to be forwarded in a stateless mode over a first path to said access node device gateway (4), where the first path is a default path, or in a stateful mode over a second path to a destination node, where the second path is determined by user and/or session specific information for said user node (3).

[0014] According to a fifth aspect of the invention, the aforementioned and other objects are achieved by a method at a gateway node (4) of a communication network (2), wherein the method comprises the steps of : receiving (400) data packets from a user node (3); identifying (500) said user node (3); and transmitting (600) instructions to one or more access node devices (1) whether data packets from said user node (3) are to be forwarded in a stateless mode over a first path to said device from gateway node (4), where the first path is a default path, or in a stateful mode about a second path to a destination node, where the second path is determined by user-specific information and/or or session for said user node (3).

[0015] User-specific information is information that relates to a specific customer of a service provider. A single user with a single user device/node can have customer relationships with multiple service providers. Therefore, there can be multiple parallel instances of user information against a single user device.

[0016] Session-specific information is information about a single session of a user, in relation to one or more services provided by a service provider. A service provider may provide multiple different character services which are therefore endowed with separate session information. Alternatively, a service provider can bundle multiple services into a single session to limit the number of sessions. If the service provider limits the number of sessions to one per user, the session information would match the user information.

[0017] The present invention provides a solution that reduces session startup time for sessions that do not need special QoS handling. Also, less signaling and processing on the access network is required since user-specific state and processing is minimized for sessions with low packet transmission frequency.

[0018] Furthermore, roaming is made simple for the access network provider as it does not need to treat all users individually while forwarding data packets in stateless mode. Instead, a service provider may be accountable for the aggregated traffic of its customers on an access network.

[0019] The present invention implies the decoupling of the access network from the core network allowing different technical solutions and providers of the different parts, for example in relation to addressing. This has the benefit that only the gateway needs to probe the data packet to identify the user and context. For longer sessions, resource allocation can be optimized if context/state information is available on the access network.

[0020] Enhanced location privacy is also provided by preferred embodiments of the invention; the access network knows where the user node is, but not the identity. The service provider knows the identity, but has only vague information about the user's location (just what network the user node is on). Compared to current cellular systems, this separation of issues improves location privacy.

[0021] According to an embodiment of the present access node device, the access node device is further arranged to forward data packets in stateless mode or stateful mode depending on the type of service associated with the data packets. This allows the access node device to forward data packets in stateless mode with minimal signaling and processing for some services, while providing sufficient quality for all services by forwarding data packets in stateful mode for services with higher requirements. .

[0022] According to yet another embodiment of the present access node device, the access node device is further arranged to forward data packets in stateful mode if: A) an arrival delay time for a flow of data packets is less than a time of arrival threshold and/or B) the number of data packets in a received stream of data packets is greater than a threshold of maximum consecutive data packets in the stream. This is a way of selecting the forwarding mode based on measurements on the traffic characteristics, which does not require any information about the services. It is therefore also useful for service providers who provide, for example, access to the Internet. Service providers that provide value-added services typically have more information about specific service requirements and can therefore configure service-dependent thresholds. It is clear to those skilled in the art that there are different levels of service information that can be used, such as the protocols used in different layers of the protocol stack.

[0023] According to yet another embodiment of the present access node device, the access node device is further arranged to initially forward the data packets in stateless mode. This pattern will allow the first packets to be sent with minimum interval and optimize packet handling only when motivated.

[0024] Still according to another embodiment of the present access node device, said destination gateway node (4) is a service provider gateway node, SPGW, associated with a service provider specific. This would make it easier for companies that sell network access bundled with a device or service, such as eBook readers attached to a specific store or car navigation devices that download traffic information to use different access networks. Then the service provider can provide value-added services such as: video streaming, voice and video calls, internet commerce, navigation services, map services, cloud services, sensor data collection, machine-type communication , access to social networks, etc.

[0025] According to the above embodiment, the access node device is further arranged to forward data packets in stateless mode, according to an identifier that identifies a service provider network associated with the SPGW. This does not require the access node device operator to take into account anything other than the service provider identity during data packet forwarding, as the service provider handles the customer relationship. Including the service provider identifier in each data packet allows forwarding in stateless mode.

[0026] According to the above embodiment, the identifier is a globally unique identity for the service provider network. The globally unique identity can be a Uniform Resource Identifier (URI) or an Internet Protocol (IP) address. Global uniqueness has the advantage that the user node can use the same service provider ID regardless of which communication network the data packets are transmitted over.

[0027] According to the above embodiment, the access node device is further arranged to use a routing table to map the service provider identities with SPGW addresses while forwarding the data packets in stateless mode. This allows the access node device to forward data packets in stateless mode with minimal interval while maintaining a relatively stable routing table of a size that is proportional to the number of service providers with which it has contractual agreements. This is effective from a storage and processing point of view.

[0028] According to yet another embodiment of the present access node device, the access node device is further arranged to use a reserved link layer address to identify data packets forwarded in stateless mode. This has the advantage that it would be possible for the access node to forward the packet in stateless mode even if it does not support IP routing.

[0029] According to yet another embodiment of the present access node device, the access node device is further arranged to forward data packets in stateless mode to said destination gateway node (4) by at least one tunnel. By using a tunnel between the access node device and the SPGW, there is the advantage that the data packets are encapsulated with additional headers with the address of the SPGW, which is not normally present in the transmitted packet and is therefore possible apply encryption on the tunnel to improve security.

[0030] Still according to another embodiment of the present access node device, user-specific information refers to one or more in the group comprising: subscription type, encryption keys, quality of service requirements, information of billing, active services of a user node, active applications of a user node, and security requirements of a user node. This information is suitable for determining the proper handling of data packets when forwarding them in stateful mode.

[0031] According to the above embodiment, the access node device is further arranged to use user and/or session specific information in stateful mode to control one or more system parameters in the group comprising: path, priority , encryption, quality of service, error control, rate limits, traffic limits, and congestion volume limits. This has the advantage that data packets associated with different services and users can be treated differently to satisfy varying requirements.

[0032] According to yet another embodiment of the present access node device, the access node device is further arranged to receive instructions, whether data packets are to be forwarded in stateless mode or in stateful mode, to from said destination gateway node (4). This has the advantage that the access node device does not need to have access to any service or user specific information before this decision is made, it is sufficient for SPGW to have access to the information.

[0033] According to yet another embodiment of the present access node device, the access node device is further arranged to receive instructions about policing, charging and security for data packets from the gateway node destination (4) when switching from stateless mode routing to stateful mode routing. This has the advantage that the mentioned functions can be applied close to the user nodes and provides better security for the user nodes and also improves resource usage on the network by applying policing as early as possible for traffic arriving at from the user node.

[0034] According to the above arrangements, the instructions are only valid for a transmission session for said user node (3). This has the advantage that separate sessions for the same user node can be treated differently. In particular, it is beneficial that different service can be given to sessions from one user node to separate service providers.

[0035] Furthermore, according to an embodiment of the present gateway node device, the one or more access node devices (1) are instructed to forward data packets from said user node (3) in stateless mode or in stateful mode, depending on the type of service associated with data packets from said user node (3). This allows the gateway node device to forward data packets in stateless mode with minimal signaling and processing for some services, while providing sufficient quality for all services by forwarding data packets in stateful mode for services with requirements. taller.

[0036] According to another embodiment of the present gateway node device, the one or more access node devices (1) are instructed to forward the data packets in stateful mode if: A) an interval time arrival time for a stream of data packets from said user node (3) is less than an arrival interval time threshold, and/or B) a quantity of data packets in a received stream of data packets from said user node (3) is greater than a maximum threshold of consecutive data packets in the stream. This is a way of selecting the forwarding mode based on measurements on the traffic characteristics, which does not require any information about the services. It is therefore also useful for service providers who provide, for example, access to the Internet. Service providers that provide value-added services typically have more information about specific service requirements and can therefore configure service-dependent thresholds. It is clear to those skilled in the art that there are different levels of service information that can be used, such as the protocols used at different layers of the protocol stack.

[0037] According to yet another embodiment of the present gateway node device, an identity of said user node (3) is encrypted by means of a public key of said gateway node device (4) . This modality allows user nodes to connect to a service provider across different access networks without the need for an existing secret key pair, and is therefore an effective way to implement initial access to the service provider.

[0038] According to yet another embodiment of the present gateway node device, the gateway node device is further arranged to discard data packets received from said user node (3) if the said user node (3) is not authorized to transmit data packets to a service provider associated with said gateway node device (4). This modality allows access nodes to forward all data packets to the gateway node without requiring authentication or authorization in the access network. Since unauthorized data packets are dropped by the gateway node, there is no incentive for malicious user nodes to send such data packets to the network. Access network nodes are therefore relieved of processing regarding security procedures.

[0039] The present invention also relates to a computer program, distinguished by code means which, when executed by processing means, causes said processing means to execute any method according to the present invention. Furthermore, the invention also relates to a computer program product comprising a computer readable medium and said computer program mentioned, wherein said computer program is included in the computer readable medium, and comprises one or more from the group: ROM (Read Only Memory), PROM (Programmable ROM), EPROM (Erasable PROM), flash memory, EEPROM (Electrically EPROM) and hard disk drive.

[0040] Additional applications and advantages of the invention will become apparent from the detailed description below.

BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The attached drawings are intended to clarify and explain different embodiments of the present invention, in which: - Figure 1 illustrates an embodiment of the present invention; - Figure 2 illustrates another embodiment of the present invention; - Figure 3 illustrates a bootstrapping solution that supports UL and DL transmission; - Figure 4 illustrates an embodiment of an addressing solution; - Figure 5 shows a flowchart to decide in which mode an access node should operate; - Figure 6 illustrates an access node device according to an embodiment of the present invention; - Figure 7 illustrates an alternative access node device according to an embodiment of the present invention; - Figure 8 illustrates how RAN and service provider network constitute separate network domains; - Figure 9 illustrates that multiple RANs and multiple service provider networks are connected together; - Figure 10 illustrates a method in an access node, according to the present invention; - Figure 11 illustrates an embodiment of a gateway node device according to the present invention; - Figure 12 illustrates an alternative embodiment of a gateway node device in accordance with the present invention; and Figure 13 illustrates one embodiment of a method on a gateway node device in accordance with the present invention.

DETAILED DESCRIPTION

[0042] The present invention relates to an access node device and a corresponding method for forwarding data packets in a communication network, such as LTE, wireless LAN (WLAN), Universal Mobile Telecommunications System (UMTS), Code Division Multiple Access (CDMA) 2000, Worldwide Interoperability for Microwave Access (WiMAX) or any other suitable communication networks.

[0043] The communication network that a user device, or user node, connects to will be called the access network, or Radio Access Network (RAN). According to the present invention, data packets can be transmitted in the network using two different modes, i.e., a stateless mode in which the access network forwards packets along a predetermined standard path with minimal packet processing. , for example, without the use of additional encryption or quality of service mechanisms, or a stateful mode in which forwarding of packets from a user node can be optimized in different ways, for example in terms of path, priority, encryption, and error handling based on user and/or session specific information for the user node.

[0044] This is achieved with the present access node device 1 arranged to receive and forward data packets in a communication network 2. The present access node device 1 comprises at least one processor 20 arranged to: receive data packets from a user node 3; and forwarding the data packets in a stateless mode over a first path to a destination gateway node 4, where the first path is a default path, or forwarding the data packets in a stateful mode over a second path to a destination node (eg an application server), where the second path is determined by user and/or session specific information for said user node 3. It should be noted that in some cases, the paths used in stateless mode and stateful mode can traverse the same physical links and nodes, but be logically separate, e.g., be sent in different traffic classes, over separate bearers or tunnels, and therefore, through processing, packets of data are received on different logical paths.

[0045] One embodiment of the device 1 is illustrated in Figure 6. The access node device 1 is arranged to receive data packets originating from a user device and to forward the data packets so that the packets from data finally reaches the destination communication port 4 through the network. Then, the access node device comprises a receiving unit (Rx) for receiving data packets and a transmitting unit (Tx) for transmitting/forwarding data packets. The present processor 20 is therefore arranged to receive data packets from a user node 3; and forwarding the data packets in stateless mode over a first path, or stateful mode over a second path. The access node device may also have memory for temporary storage of data packets and for processor 20 to retrieve program instructions therefrom.

[0046] Alternatively, according to another embodiment of the invention, the present access node device 1 comprises dedicated units for performing the different functions. This embodiment is illustrated in Figure 7 where the access node device 1 comprises dedicated units suitably connected together. The device according to that embodiment comprises a receiving unit (Rx), a transmitting unit (Tx) and a stateless mode unit arranged to receive and transmit data packets according to the stateless mode and a unit stateful mode arranged to receive and transmit data packets according to stateful mode. A dedicated control unit can control two mode units so that the access node device operates in the correct mode in accordance with the invention.

[0047] In stateless mode, the amount of user or session related state information on the access network is kept to an absolute minimum while forwarding data packets. However, in stateful mode, the access network maintains user and/or session specific information to be used for user and/or session specific handling of data packets during forwarding of data packets.

[0048] In stateless mode, data packets from a user node are forwarded by one or more access nodes of a RAN to a destination gateway node of the communication network (the gateway node of the destination is not part of the RAN) by a predetermined default path. This means that the one or more access nodes of the communication network forward the data packets in stateless mode without inspecting user and/or session specific information of the data packets except for the possible mapping table in the access node for data forwarding. possible return traffic from the destination gateway node to the user device.

[0049] The gateway node can be based on a router platform or server platform and implements, for example, functions that receive traffic, identify users, apply AAA for the user. It can also be part of a data center, and it can be deployed as part of a content delivery network. Access nodes can, on the other hand, for example, be an eNB, Wi-Fi access point, nodeB or Radio Node Controller (RNC) in UMTS, which are arranged to provide the user node with access to the communication network and forward network-layer traffic in an access network.

[0050] According to an embodiment of the present invention, user-specific information refers to one or more in the group comprising: subscription type, encryption keys, quality of service requirements, billing information, active services of a user node, active applications of a user node, and security requirements of a user node. In yet another embodiment, the access node device is further arranged to use the user and/or session specific information in stateful mode to control one or more system parameters in the group comprising: path, priority, encryption, quality of service, error control, rate limits, traffic limits, and congestion volume limits.

[0051] According to yet another embodiment of the invention, the present access node device is further arranged to receive instructions from the destination gateway node 4 whether the data packets are to be forwarded in stateless mode or in stateless mode. stateful mode. The destination gateway node 4 may also signal instructions regarding policing, charging and security for data packets to the access node device during the switch from stateless mode forwarding to stateful mode forwarding. The above-mentioned instructions from the destination gateway node 4 are only valid for a transmission session to the user node 3, still according to another embodiment of the invention.

[0052] Furthermore, the present communication system can be arranged, according to another embodiment of the invention, so that the destination gateway node can be a Service Provider Gateway (SPGW) node belonging to to a service provider that has a low-complexity technical interface with the access network, and may have contracts with access network providers that specify auditing and charging for aggregated traffic (in the following disclosure, the terms port node target communication and SPGW will be used interchangeably). According to yet another embodiment, this could mean that data traffic transmitted in stateless mode would be handled similarly to current interdomain Internet traffic on a contractual level, so that it does not need to identify specific users, but only measure aggregate traffic volumes. This would make it easier for companies that sell network access bundled with a device or service, such as eBook readers attached to a specific store or car navigation devices that download traffic information to use different access networks. Then the service provider can provide value-added services such as: video streaming, voice and video calls, internet commerce, navigation services, map services, cloud services, sensor data collection, machine-type communication , access to social networks, etc.

[0053] The choice of using stateless or stateful mode for transmitting data packets in the communication network depends on the characteristics and requirements of the data packet traffic. For example, a flow of data packets can be defined as a set of sequential packets between the same source (a user node) and a destination (gateway node) with a packet arrival interval time below some threshold, for example 10 seconds. With such a definition, short flows, that is, flows with only a few packets would typically be most efficiently transmitted in stateless mode to avoid the flow-specific state having to be maintained in the network. The exact packet arrival interval time threshold to define a flow depends on what is reasonable from a deployment point of view. It should also be noted that, in the current context, all traffic going to the same destination gateway can be considered as the same flow. Typically, in stateful mode, there will be some effort required to keep the state information up to date, in particular when the user is on the move, which also means that the user's device may experience increased power consumption due to the required signaling.

[0054] A typical pattern, according to one embodiment of the invention, is to start a flow in stateless mode, as the state will not normally be proactively set, and then move to stateful mode if one or more conditions are satisfied. If it is a flow that will benefit from stateful mode, the gateway node can transfer the state information to the access nodes when needed by suitable signaling methods. This pattern will allow the first packets to be sent with minimum interval and optimize packet handling only when motivated.

[0055] Transmission in stateless mode can work as follows: • A user device sends data packets to the access network using normal medium access methods, for example, contention based, such as Sensory Multiple Access - Carrier Access (CSMA) or request resources through a Random Access Channel (RACH). The RAN access node grants the resources or accepts the data packets without checking that the user has a subscription to use the network; • The access node forwards the data packets to the SPGW using a standard path with standard QoS handling and without any additional encryption. The default path is determined based on the unencrypted address information in the packet which is sufficient for the access network to infer the SPGW address. The security of transmissions must be handled between the user device and the SPGW, for example, using long-lived shared secrets; • SPGW identifies the user device or device user. Typically, there will already be a security context between the user device and the SPGW so that the SPGW can decrypt the data packet from the user device and read the user device identity. It should be noted that the identity of the user device or its user is independent of the RAN, so it could, for example, be the account name of any internet service that the service provider offers;

[0056] It should be clear that an identity of a user device or user node can refer to some user identity that is associated with the user device, for example, a user account name for a service that the service provider service offers to the user. Although user node identity or user device identity is mentioned, each user node can therefore have separate identities connected to different service providers, and the identities may not be statically connected to a user node.

[0057] Figure 1 illustrates an embodiment of the present invention. In the first step 1) of Figure 1, an access procedure between the access network and the user node is performed. This may follow the required specifications of the specific access network and include, for example, accessing a random access channel and will typically result in the user node receiving a temporary local address or the access node learning the local address that the user node uses. In the second step 2), the user node encrypts its identity and the data that will be transmitted with encryption methods and keys that are known by the service provider. In the third step 3), the user node transmits the data to the access node, with the data encrypted and an identification of the service provider to which it is destined. In the fourth step 4), the access node forwards the data over a default path to the SPGW based on the service provider ID provided by the user node. In one embodiment, the access node encapsulates the packet with IP and User Datagram Protocol (UDP) headers that are addressed with a destination IP address of the service provider gateway, and IP address of access node source, destination and source UDP ports X and Y that are uniquely selected by the access node to the user node that transmitted the packet. Alternatively, UDP ports can be provided by the user node. In the fifth step 5), the SPGW decrypts the data transmitted by the user node using the known encryption keys, while selecting the encryption keys, for example, based on the used UDP ports, or using one of the additional modalities which are described in Figure 2 and Figure 3 below. In the sixth step 6), SPGW encrypts the data and sends it back to the tunneled access network with access node IP address as destination IP address, SPGW IP address as source address, and the destination and source UDP ports Y and X that were used in the packet received from the access node. In the seventh step 7), the access node uses its mapping from IP addresses and port number to identify the user node to which it should address the packet and transmits the packet using the local address of the user node. Finally, the user node receives the data and can decrypt the packet.

[0058] Still according to another embodiment of the invention, SPGW applies policies to decide how data packets should be treated, in particular, whether they should be discarded or forwarded. Policies can, for example, be based on subscription data for the identified user device. SPGW will also handle user device billing for data traffic. The SPGW provider would be accountable for traffic incurred on the access network and would base its policies on its contracts with the RAN provider. Examples of functions handled by SPGW are therefore policing, billing, and security for user device node data packets.

[0059] A particular class of policing that SPGW can apply is to configure a specific connection state on the access network, so that packets belonging to the same connection receive particular treatment, for example, for QoS or better security.

[0060] Figure 5 shows a flowchart of another embodiment of the present invention. As shown in Figure 5, the destination gateway receives information about a data stream for a user node. In this embodiment, the gateway node checks by condition 1) an arrival delay time for a stream of data packets is less than a threshold arrival delay time, and by condition 2) an amount of data packets in a received stream of data packets is greater than a maximum threshold of consecutive data packets in the stream. If this is TRUE, the access nodes must operate in stateless mode while forwarding the packets on the communication network and a control signal can be transmitted to the one or more access nodes that inform them of the preferred mode, or the same can continue to use this mode by default. Otherwise, if this is not TRUE (that is, FALSE), a control signal is transmitted to the one or more access nodes that must operate in stateful mode.

[0061] To make the mode selection effective, the arrival interval threshold values can be based on typical time constants and the amount of signaling on the radio interface, as well as on the return traffic interfaces of the access network, for example, how long the user node will remain active after it has sent a packet and how much signaling is required to set up new connections on both the radio interface and the return traffic interface. The algorithm can also take into account the typical behavior of the applications and services used. For example, configuring thresholds so that applications don't need high performance typically using stateless mode might be a preferred policy. It is also noted that the threshold can be dependent on the type of service associated with the data packets.

[0062] So, in short, according to an embodiment of the invention, data packets are forwarded in stateful mode if: A) an arrival delay time for a stream of data packets is less than a threshold of arrival delay time, and/or B) the number of data packets in a received stream of data packets is greater than a maximum threshold of consecutive data packets in the stream. A specific embodiment of this particular modality is: data packets are forwarded in stateful mode if both condition A) and condition B) are TRUE.

[0063] It is also noted that, according to a preferred embodiment of the invention, the decision whether the access nodes should operate in stateful or stateless mode is performed by the destination gateway node 4, as described above. Then, the decision step of Figure 5 is, according to this embodiment, performed at the destination gateway node which signals control instructions to the access nodes in that regard.

[0064] With regard to addressing issues, there are three different levels of addresses or identities, according to another embodiment of the invention, namely: 1. A permanent identity/address known only to the home network and encrypted between the user device and the home network for privacy reasons; 2. An address that is used in the visited network needs to support bidirectional traffic between the user device and the gateway node. If the service provider (SPGW) does not need to reach the user, this address may not be required; and 3. A service provider identification that allows the access network to route the packet to the right gateway.

[0065] In short, the address 1) is used for user identification by the service provider. Address 2) is used by the access network to identify the user device and to route Downlink (DL) traffic. Address 3) is used to route Uplink (UL) traffic. In the following sections, possible solutions and preferred embodiments for these are described.

[0066] The access node(s) would (would) maintain a mapping from the Service Provider Identity (ID) to a path for transmission to the SPGW. This is the third address 3) referred to in the previous section. The path can, for example, be an IP address, an IP tunnel, or a Multiprotocol Label Switching (MPLS) path/label. An example mapping table is illustrated in Table 1, which illustrates how a list or service provider identities can be mapped to IP addresses. The identification of the service provider can be, for example: a) inferred from the sender's IP address; b) the IP address of a service provider gateway; c) a URI that would correspond to a network address over the access network; d) an Access Point Name (APN) (in 3GPP networks); e) a service provider identification of a predetermined format that is allocated by ITU or similar (such as a PLMN-ID); f) an IP address allocated by each service provider in agreement with the access network provider for the purpose of identifying the service provider; g) a name defined by an information-centric network scheme.

[0067] The inclusion of the service provider identifier should preferably be compatible with different access network technologies. One modality that satisfies this requirement is based on IP addresses, as virtually all access networks support IP addressing. By having IP addresses allocated to each service provider, this can be achieved. If the service provider has control of a public IP address range, routing can be based directly on that address. That is, the user's device would use a specific IP address outside the service provider's address range, for example, the lowest address. However, relying directly on IP routing has some drawbacks: it doesn't work for service providers that don't have a public IP address range, second, it introduces a dependency between IP routing tables and forwarding that can restrict the possibility of use effective routing of packets from the access network to different SPGWs. This is due to the fact that there will typically be multiple SPGWs in different locations, but to make this transparent to the user device, only one service provider ID should be needed. To prevent all SPGWs from having to be in the service provider's IP domain, IP routing based on this address should be avoided.

[0068] The option of an IP address allocated by each service provider in agreement with the access network provider for the purpose of identifying the service provider is therefore a good solution. In case the service provider has access to a public IP address range, it can select one of the addresses in that range to use as the service provider ID. All user devices that can connect to the service provider would be configured with this IP address as the service provider ID. If the service provider does not have access to a public IP address range, or if private IP addresses are preferred, the service provider and access network providers can agree to reserve a private IP address for the ID of service provider. It should be noted that the service provider should preferably have only one service provider ID in agreement with all access network providers, which can be achieved using an intermediary organization such as a company, a standardization body or another international organization, which allocates the addresses. The access network would then need to maintain a special table to identify packets sent with any of the allocated service provider IDs, and in particular the access networks need to prevent these addresses from being allocated to other users or used for routing. normal within their domains. When an access network receives a packet from a user with one of the reserved IP addresses as a destination, it recognizes that the packet must be forwarded to an SPGW.

TABELA 1: MAPEAMENTO DE ID DE PROVEDOR DE SERVIÇO PA- RA O CAMINHO NA REDE[0069] The access node would maintain a mapping from the service provider ID to a path for transmission to the destination SPGW. The path can, for example, be given to an IP tunnel, an MPLS path/label, or determined by normal IP routing. An example of the mapping table is illustrated in Table 1. The access network would encapsulate the packet in a manner suitable for transmission to the service provider. It could use an encrypted tunnel between the access network and the SPGW, but there is no particular need for this.

TABLE 1: MAPPING SERVICE PROVIDER ID TO NETWORK PATH

[0070] To make detection of stateless mode transmissions more effective at access nodes, it may be preferred to use specific lower-layer mechanisms to recognize when a packet is destined to be forwarded in stateless mode. This can, for example, be achieved by sending the packet with a specific reserved link layer destination address. This has the advantage that it would be possible for the access node to forward the packet in stateless mode even if it does not support IP routing.

[0071] This modality is particularly favorable when the service provider ID is not in the form of an IP address. For example, the service provider ID can be in the form of a text string as in examples c), d), e) and in some cases g) above. In this case, the service provider ID typically needs to be included as part of the link-level frame data sent to the access network. The reserved link layer address would allow the access network to recognize that the packet is destined for an SPGW. The access node would therefore read part of the data indicating the service provider ID. That part of the data can be sent unencrypted, for example at the beginning of the data frame. May be preceded by a length field, or use of a field character defined end to indicate the end of the service provider ID. An advantage of this type of service provider IDs over IP addresses is that it allows greater freedom in assigning identifiers and minimizes the need to coordinate the allocation of IDs. It should be noted that in stateful mode there is no need to include the service provider ID in the packet, so it is necessary for the use of access node to recognize that it is a packet that must be sent in stateless mode before read the field containing the service provider ID. Using a reserved link layer address allows different packet formats to be used without causing errors.

[0072] Regarding the issue of user device identification, there must be a permanent identity known only to the home network and encrypted between the user and the home network (for privacy reasons). This could be, for example: the International Mobile Subscriber Identity (IMSI); a node/user ID; a long-lived IP address; an upper-tier customer ID, for example, a username for a service or a customer number.

[0073] Also, an address that is used on the visited network is required to support bidirectional traffic. If the home network (SPGW) does not need to reach the user node, this address may not be required. This address can be: a) an IP address (or similar) assigned by the home network on a relatively short lease for privacy reasons; b) the link-local addresses, for example, 802.11 MAC that would be known to both the home and visited network; c) Temporary Cell Radio Network Identifier (CRNTI) (or equivalent) that the visited network would need to inform the home network about.

[0074] A minimal solution that can be used to identify a user is illustrated in Figure 2. If the security context is not established, the SPGW must perform the AAA tasks with the help of available servers and databases. For example, the user node could send its identity in encrypted form and use an SPGW public key to encrypt the identity in an asymmetric encryption method. SPGW can then decrypt using its private key and identify the user based on a long-lived/permanent identity. The user can also encrypt the rest of the message with their private key, so that SPGW can decrypt it with the user's public key once the user's identity is decrypted.

[0075] Figure 2 illustrates how the network can receive data and identify the user based on a permanent identity, this would be sufficient only when UL traffic is requested. However, to also support return traffic to the user device, additional functionality is required. It should be noted that the service provider may apply different policies if both UL and DL traffic are to be allowed for a session.

[0076] Figure 2 shows a minimal modality that can be used to initiate communication between the user node and the SPGW using only long-lived asymmetric encryption keys and a long-lived user identity. In the first step 1), the user node encrypts the data using its own private key and its identity using the public key of the service provider associated with the SPGW. The user node addresses the packet to the service provider and sends it to the access node. In the second step 2), the access node encapsulates the packet in an IP header addressed with a destination IP address from the SPGW, and a source IP address from the access node. SPGW can then use its own private key to decrypt the user node's identity. With the information about the user's identity, it can select the user's public key and decrypt the data.

[0077] Figure 3 illustrates a more typical embodiment, in which the access network uses a local addressing scheme. This could be, for example, Temporary Radio Network Identifiers (RNTI) as used in LTE or MAC addresses as used in 802.11. The access network can therefore address traffic back to the user. The access network forwards the packets from the user to the SPGW according to the service provider address/identifier provided in each packet, without knowing any global identity of the user. However, in order to be able to distinguish which SPGW return traffic should be forwarded to each user, the access network integrates each user packet into a UDP packet, with port numbers specific to each user. It stores the mapping between the local user identifier (eg RNTI or MAC address) and UDP port numbers for the specific SPGW. Using this stored mapping, the access network can then forward the traffic back to the right user.

[0078] In the first step 1) of Figure 3, an access procedure between the access network and the user node is performed. This may follow the required specifications of the specific access network and include, for example, accessing a random access channel and will typically result, in step 2), in that user node receiving a temporary local address or the access node receiving learns the local address that the user node uses. Then, the user node applies asymmetric encryption to encrypt the data using its own private key, and its identity using the service provider's public key. The user node addresses the packet to the service provider and sends it to the access node. In the third step 3), the user node transmits the data to the access node, with the data encrypted and an identification of the service provider to which it is destined. In the fourth step 4), the access node forwards the data over a default path to the SPGW based on the service provider ID provided by the user node. In one embodiment, the access node encapsulates the packet with IP and UDP headers that are addressed with an SPGW destination IP address, and access node source IP address, destination UDP X and Y ports, and source that are uniquely selected by the access node to the user node that transmitted the packet. In the fifth step 5), SPGW uses its own private key to decrypt the user node identity. With the information about the user's identity, it can select the user's public key and decrypt the data. SPGW also allocates a temporary identity from a namespace owned by the service provider to be used by the user node and possibly also derive new encryption keys to be used in communication between the user node and the SPGW. In the sixth step 6), SPGW encrypts the data and sends it back to the tunneled access network with access node IP address as destination IP address, SPGW IP address as source address, and the destination and source UDP ports Y and X that were used in the packet received from the access node. The SPGW also includes the temporary ID that was allocated to the user node, and encryption keys, if applicable. Of course, the new encryption keys would need to be encrypted by known asymmetric encryption keys, ie at least the public key of the user node. In the seventh step 7), the access node uses its mapping from IP addresses and port number to identify the user node to which it should address the packet and transmits the packet using the local address of the user node. The access node can also store the user node's temporary ID and use that instead of the UDP ports when routing data to the user node. Finally, the user node receives the data and can decrypt the packet.

[0079] SPGW may also assign an address or alias identifier to the user that can be used in decrypted form while the user roams on other networks. This can be, for example, an IP address, even if it is not used for IP routing, due to the fact that IP addresses are easy to handle for networks. This pseudonymous address can then serve the role of identifying the user in SPGW before messages are decrypted. Encryption keys for symmetric encryption can also be exchanged using asymmetric encryption keys. Then, symmetric encryption can be used once SPGW has the pseudonym to identify the user and can apply the right encryption keys. It is preferred to avoid using asymmetric encryption and permanent addresses in frequent transmissions as it would be possible to distinguish unique users even if it is not possible to identify them. A possible addition to make the encrypted user identity unique across multiple transmissions is to apply a function to obscure the identity based on some information that is available at both ends, such as the clock time and date, or some information that is included in the package so that the recipient can use it for decryption. To maintain user privacy, the pseudonymous address may be relatively short-lived, and a new address may be reassigned periodically. An alternative would be to use some hash function to generate the nickname from the permanent address, while including eg time information to make the nickname change over time and thus protect user privacy.

[0080] Once the user node identity has been established and encryption keys are shared between the user and the SPGW, it is possible for the user to send traffic to the SPGW, as well as through other access networks. A preferred solution that should work for different access networks would be for the access network to allocate or use a lower layer address. This address is not communicated to the service provider. Instead, SPGW provides the user with an upper-layer alias address. Even if an IP address is used as an alias, the access network would not typically use the alias for IP layer routing of the packet, but would use it to map the user for transmission by the return traffic to the SPGW. This would not entail setting up an IP tunnel, but rather, for example, sending a UDP with user-specific port numbers over an existing IP tunnel. An IP tunnel can be permanently available between the access network and the SPGW, for all traffic directed to the specific service provider. This solution is illustrated in Figure 4.

[0081] Figure 4 illustrates an embodiment where the user node has been allocated a temporary ID by the service provider that the user node can use when accessing other access nodes, which may also belong to other access networks. In the first step 1) of Figure 4, an access procedure between the access network and the user node is performed. This may follow the required specifications of the specific access network and include, for example, accessing a random access channel and will typically result, in step 2), in the user node receiving a temporary local address or the access node receiving learns the local address that the user node uses. In the third step 3), the user node encrypts its data and transmits the data to the access node, with an identification of the service provider to which it is destined and the temporary ID which was previously assigned from the service provider . For local network addressing, the user node uses the address it was assigned from the access network. In the fourth step 4), the access node forwards the data over a default path to the service provider gateway based on the service provider ID provided by the user node. In one embodiment, the access node encapsulates the packet with IP and UDP headers that are addressed with a destination IP address of the service provider gateway, and a source IP address of the access node. To identify user node packets, the communication port can use the provided temporary SP ID or the destination and source UDP ports X and Y that are uniquely selected by the access node to the user node that transmitted the packet. . This mapping is stored in the access node. In the fifth step 5), SPGW receives the packet and uses the temporary ID to identify the user and select the user node's encryption key to decrypt the data. The user node can also include its permanent user ID in the package, which SPGW can use for additional security procedures, if necessary. In the sixth step 6), SPGW encrypts data and sends it back to the tunneled access network with the access node's IP address as the destination IP address and the SPGW's IP address as the source address. SPGW can also use the source and destination UDP ports Y and X that were used in the packet received from the access node to identify the user node. The SPGW also includes the temporary ID of the service provider namespace to which the user node has been allocated. In the seventh step 7), the access node uses its mapping from the SPGW IP address along with either the port numbers or the identifier provided by the temporary service provider to identify the user node to which the access node must address the packet and forward the packet using the local address of the user node. Finally, the user node receives the data and can decrypt the packet.

[0082] Although it is mentioned above that the pseudonym will not typically be used for data routing, it is possible, in some embodiments, for the pseudonym to contain the service provider ID. In that case, it will also be used for routing towards SPGW. This might be the case, for example, if the service provider allocates IP addresses from its own public address range.

[0083] It should be noted that a UE may send data to multiple SPGWs over the same access network, and the access network will maintain separate mappings for each SPGW. Thus, the user can connect to different service providers, and each service provider can use different billing and QoS provisions tailored for the specific service provided. The user would use different service provider IDs and aliases for packages for the different service providers. The access network would also maintain separate mappings for different service providers to correctly route traffic.

[0084] Multiple types of user-specific information or variables that define a state for a user can be stored and used in the access network, with different advantages. By providing encryption keys for the access network, it is not necessary to route all traffic through the SPGW. Encryption and decryption can be done on the access network which allows routing to be optimized. Another class of state is the routing state in terms of mapping addresses to specific paths, or tunnels for each user, in the communication network. It would also allow the configuration of QoS parameters, for example, reservation and resource prioritization.

[0085] Another type of state information, which is particularly important for the case where the service provider is responsible for user traffic, is policing information that can be used to prevent users from misbehaving. The service provider therefore needs to be able to provide information that allows the access network to identify traffic from individual users so that it can be policed on a per-user basis. Such information could, for example, be traffic filters, quotas, and access lists that contain address information so that the access network can identify traffic that belongs to users that need to be policed.

[0086] Still according to another embodiment of the invention, the service provider will measure the traffic through a particular access network. If the traffic level appears higher than expected, the service provider can apply more accurate monitoring of users sending and receiving traffic over that access network. The access network operator can also monitor traffic to or from different service providers and alert service providers when the traffic level appears abnormal. So, according to this modality, the SPGW (gateway node) has responsibility for, among other things, policing, billing and security for data packets from said user node when data packets are forwarded in stateless mode.

[0087] It is also possible for the service provider to measure the traffic for each individual user to determine if the traffic seems louder than normal. If this is the case, the service provider may require the access network to police traffic for specific users who exceed traffic limits by transferring them to a connection-oriented mode, where the access network maintains specific information. of user. An example of such a policy that an SPGW might apply to a user it identified is illustrated in Figure 5. This policy will establish a connection for users who frequently transmit packets.

[0088] Alternatively, SPGW may share just enough information with the access network to be able to identify and police users who send more traffic than is considered acceptable. For DL traffic, the service provider can do this kind of policing itself, as all DL traffic would pass through the SPGW while the stateless access network mode is applied for the user. For UL traffic, it would be preferred to enforce policing on the access network to prevent excessive traffic through the entire path to the SPGW before being policed. The access network must, therefore, be provided with sufficient information to make it possible to identify and police traffic for specific users. SPGW could, for example, provide a traffic filter consisting of addresses at different layers (e.g. MAC, IP, transport layer port numbers) along with a packet rate limit, data rate limit, congestion volume limit or simply a requirement to block the user. When a user is blocked from one access network, SPGW can also explicitly or implicitly redirect the user to a different access network. This may be signaled to the user before or when required to leave the access network, or via a different access network.

[0089] In another embodiment, the service provider may offer added services of specific value, such as video transmission, voice and video calls, internet commerce or access to a social network. SPGW would then have detailed knowledge of which service the user requests and the requested QoS characteristics. Depending on the agreement with the access network operator, the service provider can choose to keep the user in stateless mode or request the access network to configure the state according to QoS requirements. In particular, the SPGW can be co-located with a data center from which requested services are provided to the user. SPGW can then determine if the user requests a small amount of information or a more demanding service that is best served in a connection oriented mode, then it is preferable to switch to a connection oriented mode.

[0090] When SPGW determines that it is preferable to use a stateful mode to support QoS requirements, it may request that this QoS treatment be configured by the access network using the QoS mechanisms supported by the specific access network. In an exemplary modality, SPGW can make the request by signaling the Policing and Billing Control system of the access network operator.

[0091] Figure 8 illustrates a system overview of how the RAN and service provider network constitute separate network domains. Access nodes have default paths to reach the service provider network leading to an SPGW. The default path to a specific access node is illustrated with an arrow in Figure 8.

[0092] Figure 9 illustrates another system overview for the case with multiple RANs (only two RANs are shown in Figure 9) and multiple service providers (only two service providers are shown in Figure 9) connected together. Each access node can have separate default paths that lead to different service provider gateways. When a data packet is received from a user's device, the data packet is forwarded to the correct SPGW based on the Service Provider ID. A user device can be logically connected to multiple service providers at the same time, while not being authenticated or identified by any RAN.

[0093] The present invention also relates to a corresponding method in an access node of a communication network. The present method comprises the steps of receiving 20 data packets from a user node 3; and forwarding 200 the data packets in a stateless mode through a first path to a destination gateway node 4, where the first path is a default path, or forwarding 300 the data packets in a stateful mode through a second path to a destination node, wherein the second path is determined by specific user and/or session information for said user node 3. This is illustrated in Figure 10.

[0094] The present invention also relates to a corresponding method in a gateway node of a communication network. The method comprises the steps of receiving 400 data packets from a user node 3 of the system; identifying 500 user node 3, for example, using an identity encrypted with a gateway node's public key; and transmitting 600 instructions to one or more access node 1 devices of the system, if data packets from user node 3 are to be forwarded in a stateless mode over a first path to gateway node device 4 , where the first path is a default path, or in a stateful mode by a second path to a target node, where the second path is determined by user and/or session specific information for the user node 3. The instructions can, for example, be signed in a suitable communication protocol. The method, on the gateway node, is illustrated in Figure 13.

[0095] Furthermore, as understood by the person skilled in the art, any method, according to the present invention, can also be implemented in a computer program that has code means that, when executed by processing means, causes the processing means perform the method steps. The computer program is included on a computer-readable medium of a computer program product. The computer-readable medium can comprise essentially any memory such as a (Read Only Memory), PROM (Programmable ROM), EPROM (Erasable PROM), flash memory, EEPROM (Electrically EPROM) or a hard disk drive.

[0096] Furthermore, it is appreciated by the person skilled in the art that the present access node device and/or the communication gateway node device comprises the necessary communication capabilities in the form of, for example, functions, means, units , elements, etc., to execute this method. Examples of such other means, units, elements and functions are: processors, memory, encoders, decoders, mapping units, multipliers, interleavers, deinterleavers, modulators, demodulators, inputs, outputs, antennas, amplifiers, DSPs, MSDs, encoder TCM, TCM decoder, interfaces, communication protocols, etc. that are properly arranged together. Examples of access node device are base stations (such as eNB or NB), radio node controllers, access points (eg for IEEE 802.11) and other devices with similar functionalities and capabilities.

[0097] Especially, the processors of the present access node or gateway node devices may comprise, for example, one or more instances of a Central Processing Unit (CPU), a processing unit, a processing circuit, a processor, an Application Specific Integrated Circuit (ASIC), a microprocessor, or other processing logic that can interpret and execute instructions. The term "processor" may thus represent a set of processing circuits comprising a plurality of processing circuits, such as, for example, any, some or all of those mentioned above. The processing circuitry may further perform data processing functions for inputting, outputting and processing data comprising temporary data storage and device control functions such as call processing control, user interface control or the like.

[0098] Figure 11 and 12 illustrate two different embodiments of a gateway node device 4 in accordance with the present invention. Device 4 in Figure 11 comprises a receiver unit (Rx) for receiving data packets from a user node, a processor 30 coupled to a memory for identifying the user device and transmitting instructions to one or more access nodes about the stateful or stateless way of forwarding data packets from the user node into the system.

[0099] The alternative gateway node device 4 is illustrated in Figure 12 and comprises a receiving unit (Rx) for receiving data packets from a user node, an identification unit coupled to identify the user, a control unit to control the one or more access nodes by signaling instructions about the stateful or stateless mode of forwarding the access nodes which is performed by a transmission unit (Tx).

[00100] Finally, it should be understood that the present invention is not limited to the embodiments described above, but also refers to and incorporates all embodiments within the scope of the attached independent embodiments.

Claims (26)

1. Access node device (1) arranged to receive and forward data packets in a communication network (2) characterized in that it comprises at least one processor (20) arranged to: receive data packets from a user node (3); and forwarding data packets from the user node (3) in a stateless mode or in a stateful mode depending on a type of service associated with the data packets; wherein in stateless mode, the at least one processor (20) is arranged to forward data packets over a first path to a destination gateway node (4) according to a uniform resource identifier (URI) identifying a service provider network associated with the destination gateway node (4), the first path being a standard path; and in stateful mode, the at least one processor (20) is arranged to forward the data packets are forwarded along a second path to a destination node, the second path being determined by user and/or session specific information for the user node (3); wherein the destination gateway node (4) is a service provider gateway node (SPGW) associated with a specific service provider. 2. Access node device (1), according to claim 1, characterized in that the URI is a unique global identity for the service provider network. 3. Access node device (1), according to claim 1 or 2, characterized in that it is further arranged to use a routing table to map service provider identities with SPGW addresses when forwarding packets from data in stateless mode. Access node device (1) according to claim 1 or 2, characterized in that it is further arranged to use an alias address of the user node when routing data to the user node. 5. Access node device (1), according to any one of claims 1 to 4, characterized in that it is further arranged to use a reserved link layer address to identify data packets forwarded in stateless mode. 6. Access node device (1), according to any one of claims 1 to 5, characterized in that it is further arranged to forward data packets in stateless mode to the destination gateway node (4 ) by at least one tunnel. 7. Access node device (1), according to any one of claims 1 to 6, characterized in that the user-specific information refers to one or more in the group comprising: subscription type, encryption keys, quality of service requirements, billing information, active services of a user node, active applications of a user node, and security requirements of a user node. 8. Access node device (1), according to claim 7, characterized in that it is further arranged to use user and/or session specific information in stateful mode to control one or more system parameters in the group comprising: path, priority, encryption, quality of service, error control, rate limits, traffic limits, and congestion volume limits. 9. Access node device (1), according to any one of claims 1 to 8, characterized in that it is further arranged to receive instructions, whether data packets must be forwarded in stateless mode or in stateless mode. stateful, from the destination gateway node (4). 10. Access node device (1), according to any one of claims 1 to 9, characterized in that it is further arranged to receive instructions, on policing, charging, and security for data packets, from the node destination communication port (4) when switching from forwarding in stateless mode to forwarding in stateful mode. 11. Access node device (1), according to claim 9 or 10, characterized in that the instructions are only valid for a transmission session for the user node (3). 12. Method in an access node arranged to receive and forward data packets in a communication network (2), the method characterized in that it comprises steps of: receiving (100) data packets from a user node (3); and forwarding data packets from the user node (3) in a stateless mode or in a stateful mode depending on a type of service associated with the data packets; wherein in stateless mode, data packets are forwarded (200) over a first path to a destination gateway node (4) according to a uniform resource identifier (URI) identifying an associated service provider network to the destination gateway node (4), the first path being a default path, and in stateful mode, data packets are forwarded (300) along a second path to a destination node, the second path being determined by user and/or session specific information for the user node (3); wherein the destination gateway node (4) is a service provider gateway node (SPGW) associated with a specific service provider. 13. Method according to claim 12, characterized in that the URI is a unique global identity for the service provider network. 14. Method according to claim 12 or 13, characterized in that it is further arranged to use a routing table to map service provider identities with SPGW addresses when forwarding data packets in stateless mode . 15. Method according to claim 12 or 14, further comprising a step of using a nickname address of the user node when routing data to the user node. 16. Method according to any one of claims 12 to 15, characterized in that it is further arranged to use a reserved link layer address to identify data packets forwarded in stateless mode. Method according to any one of claims 12 to 16, characterized in that it is further arranged to forward data packets in stateless mode to the destination gateway node (4) through at least one tunnel. 18. Gateway node device (4) of a communication network (2) characterized in that it comprises at least one processor (30) arranged to: receive data packets from a user node (3) ; identify the user node (3); and transmitting instructions to one or more access node devices (1) whether data packets from the user node (3) are to be forwarded in a stateless mode over a first path to the gateway node device (4), the first path being a default path, or in a stateful mode about a second path to a target node, the second path being determined by user and/or session specific information for the user node (3) , depending on a type of service associated with data packets; wherein the target gateway node (4) is a service provider gateway node (SPGW) associated with a specific service provider identified by a uniform resource identifier (URI). 19. Gateway node device (4), according to claim 18, characterized in that the one or more access node devices (1) are instructed to initially forward data packets in stateless mode and forward the data packets in stateful mode if: A) an arrival delay time for a flow of data packets from the user node (3) is less than an arrival delay time threshold, and/ or B) a quantity of data packets in a received stream of data packets from the user node (3) is greater than a maximum threshold of consecutive data packets in the stream. 20. Communication port node device (4), according to claim 18 or 19, characterized in that an identity of the user node (3) is encrypted by means of a public key of the port node device of communication (4). 21. Gateway node device (4) according to any one of claims 18 to 20, characterized in that the gateway node device (4) is further configured to assign a nickname address or an identifier for a user that can be used in unencrypted form while the user is roaming on other networks. 22. Gateway node device (4) according to any one of claims 18 to 21, characterized in that it is further arranged to discard data packets received from the user node (3) if the user node (3) is not authorized to transmit data packets to a service provider associated with the communication port node device (4). 23. Method at a gateway node (4) of a communication network (2), the method characterized in that it comprises steps of: receiving (400) data packets from a user node (3) ; identifying (500) the user node (3); and transmitting (600) instructions to one or more access node devices (1) whether data packets from the user node (3) are to be forwarded in a stateless mode over a first path to the port node device (4), the first path being a default path, or in a stateful mode about a second path to a target node, the second path being determined by user and/or session specific information for the user node ( 3), depending on a type of service associated with data packages; wherein the target gateway node (4) is a service provider gateway node (SPGW) associated with a specific service provider identified by a uniform resource identifier (URI). 24. Method according to claim 23, characterized in that the one or more access node devices (1) are instructed to initially forward data packets in stateless mode and forward data packets in stateful mode if: A) an arrival delay time for a flow of data packets from user node (3) is less than an arrival delay time threshold, and/or B) a number of data packets in a received stream of data packets from the user node (3) is greater than a maximum threshold of consecutive data packets in the stream. 25. Method according to claim 23 or 24, characterized in that it further comprises a step of operating the gateway node device (4) to assign a pseudonym address or an identifier to a user who it can be used in unencrypted form while the user is roaming on other networks. 26. Method according to any one of claims 23 to 25, characterized in that it is further arranged to discard data packets received from the user node (3) if the user node (3) is not authorized for transmitting data packets to a service provider associated with the gateway node device (4).

Images